July 2012 - picketlink-commits - Jboss List Archives

Picketlink SVN: r1572 - in product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web: util and 1 other directory.

by picketlink-commits＠lists.jboss.org

Author: dehort Date: 2012-07-11 10:19:49 -0400 (Wed, 11 Jul 2012) New Revision: 1572 Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/constants/GeneralConstants.java product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/util/RedirectBindingSignatureUtil.java Log: Backporting a RedirectBindingSignatureUtil fix to 2.0.2 [JBPAPP-9307] Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/constants/GeneralConstants.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/constants/GeneralConstants.java 2012-07-10 19:41:13 UTC (rev 1571) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/constants/GeneralConstants.java 2012-07-11 14:19:49 UTC (rev 1572) @@ -90,6 +90,8 @@ String SAML_RESPONSE_KEY = "SAMLResponse"; + String SAML_SIG_ALG_REQUEST_KEY = "SigAlg"; + String DECRYPTING_KEY = "DECRYPTING_KEY"; String SENDER_PUBLIC_KEY = "SENDER_PUBLIC_KEY"; Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/util/RedirectBindingSignatureUtil.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/util/RedirectBindingSignatureUtil.java 2012-07-10 19:41:13 UTC (rev 1571) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/util/RedirectBindingSignatureUtil.java 2012-07-11 14:19:49 UTC (rev 1572) @@ -195,26 +195,35 @@ return getTokenValue(getToken(queryString, token)); } - public static boolean validateSignature(String queryString, PublicKey validatingKey, byte[] sigValue) - throws UnsupportedEncodingException, GeneralSecurityException - { - //Construct the url again - String reqFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, "SAMLRequest"); - String relayStateFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, GeneralConstants.RELAY_STATE); - String sigAlgFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, "SigAlg"); + public static boolean validateSignature(String queryString, PublicKey validatingKey, byte[] sigValue) + throws UnsupportedEncodingException, GeneralSecurityException { + // Construct the url again + StringBuilder sb = new StringBuilder(); - StringBuilder sb = new StringBuilder(); - sb.append("SAMLRequest=").append(reqFromURL); + if (isRequestQueryString(queryString)) { + addParameter(sb, GeneralConstants.SAML_REQUEST_KEY, + RedirectBindingSignatureUtil.getTokenValue(queryString, GeneralConstants.SAML_REQUEST_KEY)); + } else { + addParameter(sb, GeneralConstants.SAML_RESPONSE_KEY, + RedirectBindingSignatureUtil.getTokenValue(queryString, GeneralConstants.SAML_RESPONSE_KEY)); + } - if (isNotNull(relayStateFromURL)) - { - sb.append("&RelayState=").append(relayStateFromURL); - } - sb.append("&SigAlg=").append(sigAlgFromURL); + String relayStateFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, GeneralConstants.RELAY_STATE); - return SignatureUtil.validate(sb.toString().getBytes("UTF-8"), sigValue, validatingKey); - } + if (isNotNull(relayStateFromURL)) { + addParameter(sb, GeneralConstants.RELAY_STATE, relayStateFromURL); + } + addParameter(sb, GeneralConstants.SAML_SIG_ALG_REQUEST_KEY, + RedirectBindingSignatureUtil.getTokenValue(queryString, GeneralConstants.SAML_SIG_ALG_REQUEST_KEY)); + + return SignatureUtil.validate(sb.toString().getBytes("UTF-8"), sigValue, validatingKey); + } + + private static boolean isRequestQueryString(String queryString) { + return RedirectBindingSignatureUtil.getTokenValue(queryString, GeneralConstants.SAML_REQUEST_KEY) != null; + } + //***************** Private Methods ************** private static byte[] computeSignature(String requestOrResponseKeyValuePair, String urlEncodedRelayState, @@ -287,6 +296,16 @@ return sb.toString(); } + private static void addParameter(StringBuilder queryString, String paramName, String paramValue) { + String parameterSeparator = "&"; + + if (queryString.length() == 0) { + parameterSeparator = ""; + } + + queryString.append(parameterSeparator).append(paramName).append("=").append(paramValue); + } + private static String getToken(String queryString, String token) { if (queryString == null) @@ -317,4 +336,4 @@ else return token.substring(eq + 1); } -} \ No newline at end of file +}

12 years, 5 months

1
0
0 / 0

Picketlink SVN: r1571 - product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/sp.

by picketlink-commits＠lists.jboss.org

Author: dehort Date: 2012-07-10 15:41:13 -0400 (Tue, 10 Jul 2012) New Revision: 1571 Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java Log: Backporting SPRedirectSignatureFormAuthenticator fix to 2.0.2 [JBPAPP-9307] Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2012-07-10 19:38:10 UTC (rev 1570) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2012-07-10 19:41:13 UTC (rev 1571) @@ -194,8 +194,25 @@ { //Get the signing key PrivateKey signingKey = keyManager.getSigningKey(); - String url = RedirectBindingSignatureUtil.getSAMLRequestURLWithSignature(urlEncodedRequest, - urlEncodedRelayState, signingKey); + + if (signingKey == null) { + log.error("Signing is null. Check your KeyStore configuration."); + throw new RuntimeException(ErrorCodes.SIGNING_PROCESS_FAILURE); + } + + String url = null; + + if (sendRequest) + { + url = RedirectBindingSignatureUtil.getSAMLRequestURLWithSignature(urlEncodedRequest, urlEncodedRelayState, + signingKey); + } + else + { + url = RedirectBindingSignatureUtil.getSAMLResponseURLWithSignature(urlEncodedRequest, urlEncodedRelayState, + signingKey); + } + return url; } catch (Exception e)

12 years, 5 months

1
0
0 / 0

Picketlink SVN: r1570 - in product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation: core/util and 1 other directories.

by picketlink-commits＠lists.jboss.org

Author: dehort Date: 2012-07-10 15:38:10 -0400 (Tue, 10 Jul 2012) New Revision: 1570 Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/DocumentUtil.java product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/util/TransformerUtil.java product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/constants/GeneralConstants.java Log: Backporting PLFED-346 to 2.0.2 [JBPAPP-9307] Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/DocumentUtil.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/DocumentUtil.java 2012-07-10 19:36:03 UTC (rev 1569) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/DocumentUtil.java 2012-07-10 19:38:10 UTC (rev 1570) @@ -69,6 +69,8 @@ private static boolean trace = log.isTraceEnabled(); + private static DocumentBuilderFactory documentBuilderFactory; + /** * Check whether a node belongs to a document * @param doc @@ -517,14 +519,17 @@ } /** - * Create a namespace aware Document builder factory + * Creates a namespace aware {@link DocumentBuilderFactory}. The returned instance is cached and shared between different threads. * @return */ private static DocumentBuilderFactory getDocumentBuilderFactory() { - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - factory.setNamespaceAware(true); - factory.setXIncludeAware(true); - return factory; + if (documentBuilderFactory == null) { + documentBuilderFactory = DocumentBuilderFactory.newInstance(); + documentBuilderFactory.setNamespaceAware(true); + documentBuilderFactory.setXIncludeAware(true); + } + + return documentBuilderFactory; } -} \ No newline at end of file +} Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/util/TransformerUtil.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/util/TransformerUtil.java 2012-07-10 19:36:03 UTC (rev 1569) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/util/TransformerUtil.java 2012-07-10 19:38:10 UTC (rev 1570) @@ -73,6 +73,8 @@ private static final boolean trace = log.isTraceEnabled(); + private static TransformerFactory transformerFactory; + /** * Get the Default Transformer * @return @@ -83,7 +85,7 @@ Transformer transformer; try { - transformer = TransformerFactory.newInstance().newTransformer(); + transformer = getTransformerFactory().newTransformer(); } catch (TransformerConfigurationException e) { @@ -99,6 +101,20 @@ } /** + * Creates a {@link TransformerFactory}. The returned instance is cached and shared between different threads. + * + * @return + * @throws TransformerFactoryConfigurationError + */ + private static TransformerFactory getTransformerFactory() throws TransformerFactoryConfigurationError { + if (transformerFactory == null) { + transformerFactory = TransformerFactory.newInstance(); + } + + return transformerFactory; + } + + /** * Get the Custom Stax Source to DOM result transformer that has been written * to get over the JDK transformer bugs (JDK6) as well as the issue of Xalan * installing its Transformer (which does not support stax). @@ -433,4 +449,4 @@ } } } -} \ No newline at end of file +} Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/constants/GeneralConstants.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/constants/GeneralConstants.java 2012-07-10 19:36:03 UTC (rev 1569) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/web/constants/GeneralConstants.java 2012-07-10 19:38:10 UTC (rev 1570) @@ -101,4 +101,6 @@ String USERNAME_FIELD = "JBID_USERNAME"; String PASS_FIELD = "JBID_PASSWORD"; -} \ No newline at end of file + + String SUBSYSTEM_RUNTIME = "picketlink.subsystem.runtime"; +}

12 years, 5 months

1
0
0 / 0

Picketlink SVN: r1569 - product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/api/saml/v2/response.

by picketlink-commits＠lists.jboss.org

Author: dehort Date: 2012-07-10 15:36:03 -0400 (Tue, 10 Jul 2012) New Revision: 1569 Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/api/saml/v2/response/SAML2Response.java Log: Backporting PLFED-276 to 2.0.2 [JBPAPP-9307] Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/api/saml/v2/response/SAML2Response.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/api/saml/v2/response/SAML2Response.java 2012-07-10 19:34:17 UTC (rev 1568) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/api/saml/v2/response/SAML2Response.java 2012-07-10 19:36:03 UTC (rev 1569) @@ -250,7 +250,7 @@ PicketLinkCoreSTS sts = PicketLinkCoreSTS.instance(); SAMLProtocolContext samlProtocolContext = new SAMLProtocolContext(); samlProtocolContext.setSubjectType(subjectType); - samlProtocolContext.setIssuerID(nameIDType); + samlProtocolContext.setIssuerID(issuerInfo.getIssuer()); AssertionType assertionType = idp.getAssertion(); if (assertionType != null)

12 years, 5 months

1
0
0 / 0

Picketlink SVN: r1568 - product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp.

by picketlink-commits＠lists.jboss.org

Author: dehort Date: 2012-07-10 15:34:17 -0400 (Tue, 10 Jul 2012) New Revision: 1568 Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java Log: Backporting PLFED-248 to 2.0.2 [JBPAPP-9307] Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2012-07-10 19:31:43 UTC (rev 1567) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2012-07-10 19:34:17 UTC (rev 1568) @@ -28,7 +28,9 @@ import java.io.File; import java.io.IOException; import java.io.InputStream; +import java.net.MalformedURLException; import java.net.URI; +import java.net.URL; import java.security.GeneralSecurityException; import java.security.Principal; import java.security.PublicKey; @@ -182,6 +184,8 @@ */ private final Lock chainLock = new ReentrantLock(); + private Boolean validatingAliasToTokenIssuer = false; + //Set a list of attributes we are interested in separated by comma public void setAttributeList(String attribList) { @@ -220,6 +224,20 @@ } /** + * PLFED-248 + * Allows to validate the token's signature against the keystore using the token's issuer. + */ + public void setValidatingAliasToTokenIssuer(Boolean validatingAliasToTokenIssuer) + { + this.validatingAliasToTokenIssuer = validatingAliasToTokenIssuer; + } + + public Boolean getValidatingAliasToTokenIssuer() + { + return validatingAliasToTokenIssuer; + } + + /** * IDP should not do any attributes such as generation of roles etc * @param ignoreAttributes */ @@ -489,8 +507,6 @@ Boolean requestedPostProfile = null; - //Get the SAML Request Message - RequestAbstractType requestAbstractType = null; String samlRequestMessage = (String) session.getNote(GeneralConstants.SAML_REQUEST_KEY); String relayState = (String) session.getNote(GeneralConstants.RELAY_STATE); @@ -511,15 +527,23 @@ { samlDocumentHolder = webRequestUtil.getSAMLDocumentHolder(samlRequestMessage); samlObject = samlDocumentHolder.getSamlObject(); + + if (!(samlObject instanceof RequestAbstractType)) { + throw new RuntimeException(ErrorCodes.WRONG_TYPE + samlObject.getClass().getName()); + } + //Get the SAML Request Message + RequestAbstractType requestAbstractType = (RequestAbstractType) samlObject; + String issuer = requestAbstractType.getIssuer().getValue(); + boolean isPost = webRequestUtil.hasSAMLRequestInPostProfile(); - boolean isValid = validate(request.getRemoteAddr(), request.getQueryString(), new SessionHolder( + String tokenSignatureValidatingAlias = getTokenSignatureValidatingAlias(request, issuer); + boolean isValid = validate(tokenSignatureValidatingAlias, request.getQueryString(), new SessionHolder( samlRequestMessage, signature, sigAlg), isPost); if (!isValid) throw new GeneralSecurityException(ErrorCodes.VALIDATION_CHECK_FAILED); - String issuer = null; IssuerInfoHolder idpIssuer = new IssuerInfoHolder(this.identityURL); ProtocolContext protocolContext = new HTTPContext(request, response, context.getServletContext()); //Create the request/response @@ -545,12 +569,13 @@ if (this.keyManager != null) { - String remoteHost = request.getRemoteAddr(); if (trace) { - log.trace("Remote Host=" + remoteHost); + log.trace("Remote Host=" + request.getRemoteAddr()); + log.trace("Validating Alias=" + tokenSignatureValidatingAlias); } - PublicKey validatingKey = CoreConfigUtil.getValidatingKey(keyManager, remoteHost); + + PublicKey validatingKey = CoreConfigUtil.getValidatingKey(keyManager, tokenSignatureValidatingAlias); requestOptions.put(GeneralConstants.SENDER_PUBLIC_KEY, validatingKey); requestOptions.put(GeneralConstants.DECRYPTING_KEY, keyManager.getSigningKey()); } @@ -572,31 +597,24 @@ log.trace("Handlers are=" + handlers); } - if (samlObject instanceof RequestAbstractType) + webRequestUtil.isTrusted(issuer); + + if (handlers != null) { - requestAbstractType = (RequestAbstractType) samlObject; - issuer = requestAbstractType.getIssuer().getValue(); - webRequestUtil.isTrusted(issuer); - - if (handlers != null) + try { - try + chainLock.lock(); + for (SAML2Handler handler : handlers) { - chainLock.lock(); - for (SAML2Handler handler : handlers) - { - handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); - willSendRequest = saml2HandlerResponse.getSendRequest(); - } + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + willSendRequest = saml2HandlerResponse.getSendRequest(); } - finally - { - chainLock.unlock(); - } } + finally + { + chainLock.unlock(); + } } - else - throw new RuntimeException(ErrorCodes.WRONG_TYPE + samlObject.getClass().getName()); samlResponse = saml2HandlerResponse.getResultingDocument(); relayState = saml2HandlerResponse.getRelayState(); @@ -654,6 +672,33 @@ return; } + /** + * Returns the alias to be used for the token's signature verification. + * + * @param request + * @param issuer + * @return + */ + private String getTokenSignatureValidatingAlias(Request request, String issuer) + { + String issuerHost = request.getRemoteAddr(); + + if (this.validatingAliasToTokenIssuer) { + try + { + issuerHost = new URL(issuer).getHost(); + } + catch (MalformedURLException e) + { + if (trace) { + log.trace("Token issuer is not a valid URL: " + issuer + ". Using the requester address instead.", e); + } + } + } + + return issuerHost; + } + protected void processSAMLResponseMessage(IDPWebRequestUtil webRequestUtil, Request request, Response response) throws ServletException, IOException { @@ -678,17 +723,22 @@ cleanUpSessionNote(request); - StatusResponseType statusResponseType = null; try { samlDocumentHolder = webRequestUtil.getSAMLDocumentHolder(samlResponseMessage); samlObject = samlDocumentHolder.getSamlObject(); - + + if (!(samlObject instanceof StatusResponseType)) + { + throw new RuntimeException(ErrorCodes.WRONG_TYPE + samlObject.getClass().getName()); + } + boolean isPost = webRequestUtil.hasSAMLRequestInPostProfile(); boolean isValid = false; - - String remoteAddress = request.getRemoteAddr(); - + StatusResponseType statusResponseType = (StatusResponseType) samlObject; + String issuer = statusResponseType.getIssuer().getValue(); + String tokenValidatingAlias = getTokenSignatureValidatingAlias(request, issuer); + if (isPost) { //Validate @@ -696,7 +746,7 @@ if (ignoreIncomingSignatures == false && signOutgoingMessages == true) { - PublicKey publicKey = keyManager.getValidatingKey(remoteAddress); + PublicKey publicKey = keyManager.getValidatingKey(tokenValidatingAlias); isValid = samlSignature.validate(samlDocumentHolder.getSamlDocument(), publicKey); } else @@ -704,14 +754,13 @@ } else { - isValid = validate(remoteAddress, request.getQueryString(), new SessionHolder(samlResponseMessage, + isValid = validate(tokenValidatingAlias, request.getQueryString(), new SessionHolder(samlResponseMessage, signature, sigAlg), isPost); } if (!isValid) throw new GeneralSecurityException(ErrorCodes.VALIDATION_CHECK_FAILED); - String issuer = null; IssuerInfoHolder idpIssuer = new IssuerInfoHolder(this.identityURL); ProtocolContext protocolContext = new HTTPContext(request, response, context.getServletContext()); //Create the request/response @@ -723,32 +772,25 @@ Set<SAML2Handler> handlers = chain.handlers(); - if (samlObject instanceof StatusResponseType) + webRequestUtil.isTrusted(issuer); + + if (handlers != null) { - statusResponseType = (StatusResponseType) samlObject; - issuer = statusResponseType.getIssuer().getValue(); - webRequestUtil.isTrusted(issuer); - - if (handlers != null) + try { - try + chainLock.lock(); + for (SAML2Handler handler : handlers) { - chainLock.lock(); - for (SAML2Handler handler : handlers) - { - handler.reset(); - handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); - willSendRequest = saml2HandlerResponse.getSendRequest(); - } + handler.reset(); + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + willSendRequest = saml2HandlerResponse.getSendRequest(); } - finally - { - chainLock.unlock(); - } } + finally + { + chainLock.unlock(); + } } - else - throw new RuntimeException(ErrorCodes.WRONG_TYPE + samlObject.getClass().getName()); samlResponse = saml2HandlerResponse.getResultingDocument(); relayState = saml2HandlerResponse.getRelayState();

12 years, 5 months

1
0
0 / 0

Picketlink SVN: r1567 - product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/sts.

by picketlink-commits＠lists.jboss.org

Author: dehort Date: 2012-07-10 15:31:43 -0400 (Tue, 10 Jul 2012) New Revision: 1567 Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/sts/PicketLinkCoreSTS.java Log: Test patch for the configuration issue [JBPAPP-9307] Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/sts/PicketLinkCoreSTS.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/sts/PicketLinkCoreSTS.java 2012-07-10 19:29:16 UTC (rev 1566) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/core/sts/PicketLinkCoreSTS.java 2012-07-10 19:31:43 UTC (rev 1567) @@ -304,7 +304,7 @@ try { // check the user home for a configuration file generated by the picketlink console. - String configurationFilePath = System.getProperty("user.home") + SEPARATOR + STS_CONFIG_DIR + fileName; + String configurationFilePath = /*System.getProperty("user.home") + SEPARATOR + STS_CONFIG_DIR + */fileName; File configurationFile = new File(configurationFilePath); if (configurationFile.exists()) configurationFileURL = configurationFile.toURI().toURL(); @@ -356,4 +356,4 @@ throw new ConfigurationException(ErrorCodes.STS_CONFIGURATION_FILE_PARSING_ERROR, e); } } -} \ No newline at end of file +}

12 years, 5 months

1
0
0 / 0

Picketlink SVN: r1566 - product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp.

by picketlink-commits＠lists.jboss.org

Author: dehort Date: 2012-07-10 15:29:16 -0400 (Tue, 10 Jul 2012) New Revision: 1566 Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java Log: Backporting PLFED-247 to 2.0.2 [JBPAPP-9307] Modified: product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2012-07-10 19:14:58 UTC (rev 1565) +++ product/branches/2.0.2_JBPAPP-9307/picketlink-core/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2012-07-10 19:29:16 UTC (rev 1566) @@ -1077,9 +1077,9 @@ log.info("Did not find picketlink-sts.xml. We will install default configuration"); sts.installDefaultConfiguration(); } - else - sts.installDefaultConfiguration(configPath); - + else + sts.installDefaultConfiguration(stsTokenConfigFile.toURI().toString()); + if (this.signOutgoingMessages) { KeyProviderType keyProvider = this.idpConfiguration.getKeyProvider();

12 years, 5 months

1
0
0 / 0

Picketlink SVN: r1565 - product/branches.

by picketlink-commits＠lists.jboss.org

Author: dehort Date: 2012-07-10 15:14:58 -0400 (Tue, 10 Jul 2012) New Revision: 1565 Added: product/branches/2.0.2_JBPAPP-9307/ Log: Creating a branch for a one off patch [JBPAPP-9307]

12 years, 5 months

1
0
0 / 0

Picketlink SVN: r1563 - in product/trunk/picketlink-core/src/main/java/org/picketlink: identity/federation/core/util and 2 other directories.

by picketlink-commits＠lists.jboss.org

Author: pskopek(a)redhat.com Date: 2012-07-04 10:43:50 -0400 (Wed, 04 Jul 2012) New Revision: 1563 Added: product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/BinaryTokenValidation.java product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/MapBasedTokenHandler.java Modified: product/trunk/picketlink-core/src/main/java/org/picketlink/identity/federation/core/ErrorCodes.java product/trunk/picketlink-core/src/main/java/org/picketlink/identity/federation/core/util/SOAPUtil.java product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/BinaryTokenHandler.java product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/jaas/JBWSTokenIssuingLoginModule.java Log: backport of [PRODMGT-153] Adding ability to use customer's own login module and supply binary security token in JAAS sharedState Map and use in new MapBasedTokenHandler to send it to STS. Modified: product/trunk/picketlink-core/src/main/java/org/picketlink/identity/federation/core/ErrorCodes.java =================================================================== --- product/trunk/picketlink-core/src/main/java/org/picketlink/identity/federation/core/ErrorCodes.java 2012-06-12 14:15:37 UTC (rev 1562) +++ product/trunk/picketlink-core/src/main/java/org/picketlink/identity/federation/core/ErrorCodes.java 2012-07-04 14:43:50 UTC (rev 1563) @@ -191,4 +191,6 @@ String WRITER_UNSUPPORTED_ATTRIB_VALUE = "PL00084: Writer: Unsupported Attribute Value:"; String WRONG_TYPE = "PL00095: Wrong type:"; + + String SOAP_MESSAGE_DUMP_ERROR = "PL00104: Error while dumping SOAP message:"; } \ No newline at end of file Modified: product/trunk/picketlink-core/src/main/java/org/picketlink/identity/federation/core/util/SOAPUtil.java =================================================================== --- product/trunk/picketlink-core/src/main/java/org/picketlink/identity/federation/core/util/SOAPUtil.java 2012-06-12 14:15:37 UTC (rev 1562) +++ product/trunk/picketlink-core/src/main/java/org/picketlink/identity/federation/core/util/SOAPUtil.java 2012-07-04 14:43:50 UTC (rev 1563) @@ -21,6 +21,7 @@ */ package org.picketlink.identity.federation.core.util; +import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.InputStream; import java.security.GeneralSecurityException; @@ -33,6 +34,7 @@ import javax.xml.soap.SOAPMessage; import javax.xml.transform.Source; +import org.picketlink.identity.federation.core.ErrorCodes; import org.picketlink.identity.federation.core.saml.v2.util.DocumentUtil; import org.w3c.dom.Document; @@ -116,4 +118,20 @@ throw new RuntimeException(e); } } + + /** + * Utility method to dump soapMessage to String. + * Used for logging purpose. Use only with TRACE level, please. + * @param soapMessage + * @return String representation of soapMessage + */ + public static String soapMessageAsString(SOAPMessage soapMessage) { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + try { + soapMessage.writeTo(baos); + } catch (Exception almostIgnored) { + return ErrorCodes.SOAP_MESSAGE_DUMP_ERROR + almostIgnored; + } + return baos.toString(); + } } \ No newline at end of file Modified: product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/BinaryTokenHandler.java =================================================================== --- product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/BinaryTokenHandler.java 2012-06-12 14:15:37 UTC (rev 1562) +++ product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/BinaryTokenHandler.java 2012-07-04 14:43:50 UTC (rev 1563) @@ -39,6 +39,7 @@ import javax.xml.ws.handler.soap.SOAPMessageContext; import org.picketlink.identity.federation.core.ErrorCodes; +import org.picketlink.identity.federation.core.util.SOAPUtil; import org.picketlink.identity.federation.core.util.StringUtil; import org.picketlink.trust.jbossws.Constants; import org.picketlink.trust.jbossws.Util; @@ -93,7 +94,7 @@ * Attribute value for the EncodingType attribute */ private String encodingType = SecurityActions.getSystemProperty("binary.http.encodingType", - "http://docs.oasis-open.org/wss/2004/01/ oasis-200401-wss-soap-message-security-1.0#Base64Binary"); + "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-secu..."); /** * Attribute value for the ValueType attribute @@ -259,15 +260,7 @@ } if( trace) { - log.trace("SOAP Message="); - try - { - sm.writeTo(System.out); - } - catch (Exception ignore) - { - log.trace("Exception tracing out SOAP Message", ignore); - } + log.trace("SOAP Message=" + SOAPUtil.soapMessageAsString(sm)); } return true; } Added: product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/BinaryTokenValidation.java =================================================================== --- product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/BinaryTokenValidation.java (rev 0) +++ product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/BinaryTokenValidation.java 2012-07-04 14:43:50 UTC (rev 1563) @@ -0,0 +1,33 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.picketlink.trust.jbossws.handler; + +import javax.xml.ws.handler.MessageContext; + +/** + * Interface for token validation to be supplied to @MapBasedTokenHandler and @BinaryTokenHandler. + * @author pskopek + * + */ +public interface BinaryTokenValidation { + public boolean validateBinaryToken(Object token, MessageContext msgContext); +} Added: product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/MapBasedTokenHandler.java =================================================================== --- product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/MapBasedTokenHandler.java (rev 0) +++ product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/handler/MapBasedTokenHandler.java 2012-07-04 14:43:50 UTC (rev 1563) @@ -0,0 +1,317 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.picketlink.trust.jbossws.handler; + +import java.util.Map; +import javax.xml.namespace.QName; +import javax.xml.soap.SOAPElement; +import javax.xml.soap.SOAPEnvelope; +import javax.xml.soap.SOAPException; +import javax.xml.soap.SOAPFactory; +import javax.xml.soap.SOAPHeader; +import javax.xml.soap.SOAPMessage; +import javax.xml.ws.handler.MessageContext; +import javax.xml.ws.handler.soap.SOAPMessageContext; + +import org.jboss.logging.Logger; +import org.picketlink.identity.federation.core.ErrorCodes; +import org.picketlink.identity.federation.core.util.SOAPUtil; +import org.picketlink.trust.jbossws.Constants; +import org.picketlink.trust.jbossws.Util; + +/** + * + * Handler that looks for a binary token data that exists in jaasOptionsMap supplied in constructor. + * + * + * Configuration: + * + * System Properties: + * <ul> + * <li>map.token.key: key which will be used to fetch binary token from the jaasOptionsMap. Default value is ClientID</li> + * <li>map.token.validation.class.key: validation class for binary token inside handleInbound method</li> + * <li>binary.http.encodingType: attribute value of the EncodingType attribute</li> + * <li>binary.http.valueType: attribute value of the ValueType attribute</li> + * <li>binary.http.valueType.namespace: namespace for the ValueType attribute</li> + * <li>binary.http.valueType.prefix: namespace for the ValueType attribute</li> + * </ul> + * Setters: + * + * Please see the see also section. + * + * + * @see #setEncodingType(String) + * @see #setValueType(String) + * @see #setValueTypeNamespace(String) + * @see #setValueTypePrefix(String) + * @author Anil.Saldhana(a)redhat.com + * @author pskopek(a)redhat.com + * @since Jun 11, 2012 + */ +public class MapBasedTokenHandler extends AbstractPicketLinkTrustHandler { + + public static final String SYS_PROP_TOKEN_KEY = "map.token.key"; + public static final String DEFAULT_TOKEN_KEY = "ClientID"; + + + /** + * The JAAS shared options map key name for binary token to be stored in. + */ + public final String tokenOptionKey = SecurityActions.getSystemProperty( + SYS_PROP_TOKEN_KEY, "ClientID"); + + /** + * Key in the JAAS options map to find class name to validate token in + * inbound message handle method. + */ + public final String validationTokenClassKey = SecurityActions + .getSystemProperty("map.token.validation.class.key", + "tokenValidationClass"); + + /** + * Attribute value for the EncodingType attribute + */ + private String encodingType = SecurityActions + .getSystemProperty( + "binary.http.encodingType", + "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-secu..."); + + /** + * Attribute value for the ValueType attribute + */ + private String valueType = SecurityActions.getSystemProperty( + "binary.http.valueType", null); + + /** + * Namespace for the ValueType. Can be null. If null, then a separate + * namespace is not added. + */ + private String valueTypeNamespace = SecurityActions.getSystemProperty( + "binary.http.valueType.namespace", null); + + /** + * Prefix for the ValueType. Can be null. + */ + private String valueTypePrefix = SecurityActions.getSystemProperty( + "binary.http.valueType.prefix", null); + + private SOAPFactory factory = null; + + /** + * Shared options from calling login module (@see + * + * @JBWSTokenIssuingLoginModule). + */ + private Map<String, ?> jaasLoginModuleOptions = null; + + public MapBasedTokenHandler(Map<String, ?> jaasOptionsMap) { + jaasLoginModuleOptions = jaasOptionsMap; + } + + /** + * + * Set the EncodingType value. + * + * + * Alternatively, set the system property "binary.http.encodingType" + * + * + * @param binaryEncodingType + */ + public void setEncodingType(String binaryEncodingType) { + this.encodingType = binaryEncodingType; + } + + /** + * + * Set the Value type + * + * + * Alternatively, set the system property "binary.http.valueType" + * + * + * @param binaryValueType + */ + public void setValueType(String binaryValueType) { + this.valueType = binaryValueType; + } + + /** + * + * Set the ValueType Namespace + * + * + * Alternatively, set the system property "binary.http.valueType.namespace" + * + * + * @param binaryValueNamespace + */ + public void setValueTypeNamespace(String binaryValueNamespace) { + this.valueTypeNamespace = binaryValueNamespace; + } + + /** + * + * Set the Value Type Prefix + * + * + * Alternatively, set the system property "binary.http.valueType.prefix" + * + * + * @param binaryValuePrefix + */ + public void setValueTypePrefix(String binaryValuePrefix) { + this.valueTypePrefix = binaryValuePrefix; + } + + @Override + protected boolean handleInbound(MessageContext msgContext) { + if (trace) { + log.trace("Handling Inbound Message"); + } + + String tokenValidation = (String) jaasLoginModuleOptions + .get(validationTokenClassKey); + if (tokenValidation == null) { + return true; + } + + BinaryTokenValidation validation = null; + try { + ClassLoader cl = SecurityActions.getClassLoader(getClass()); + validation = (BinaryTokenValidation) cl.loadClass(tokenValidation) + .newInstance(); + } catch (Exception e) { + throw new RuntimeException(ErrorCodes.CLASS_NOT_LOADED + + "Class not loaded:" + tokenValidation, e); + } + String token = getToken(msgContext); + if (trace) { + log.trace("Validating token=" + token); + } + + return validation.validateBinaryToken(token, msgContext); + } + + @Override + protected boolean handleOutbound(MessageContext msgContext) { + if (trace) { + log.trace("Handling Outbound Message"); + } + + String token = (String) jaasLoginModuleOptions.get(tokenOptionKey); + if (token == null) + throw new RuntimeException(ErrorCodes.INJECTED_VALUE_MISSING + + tokenOptionKey + + " has to be set by calling LoginMoule in option map."); + + SOAPElement security = null; + try { + security = create(token); + } catch (SOAPException e) { + log.error("Unable to create binary token", e); + } + if (security == null) { + log.warn("Was not able to create security token. Just sending message without binary token"); + return true; + } + SOAPMessage sm = ((SOAPMessageContext) msgContext).getMessage(); + SOAPEnvelope envelope; + try { + envelope = sm.getSOAPPart().getEnvelope(); + SOAPHeader header = (SOAPHeader) Util.findElement(envelope, + new QName(envelope.getNamespaceURI(), "Header")); + if (header == null) { + header = (SOAPHeader) envelope.getOwnerDocument() + .createElementNS(envelope.getNamespaceURI(), + envelope.getPrefix() + ":Header"); + envelope.insertBefore(header, envelope.getFirstChild()); + } + header.addChildElement(security); + } catch (SOAPException e) { + log.error("Unable to create binary token", e); + } + if (trace) { + log.trace("SOAP Message=" + SOAPUtil.soapMessageAsString(sm)); + } + return true; + } + + /** + * Given a binary token, create a {@link SOAPElement} + * + * @param token + * @return + * @throws SOAPException + */ + private SOAPElement create(String token) throws SOAPException { + if (factory == null) + factory = SOAPFactory.newInstance(); + SOAPElement security = factory.createElement(Constants.WSSE_LOCAL, + Constants.WSSE_PREFIX, Constants.WSSE_NS); + + if (valueTypeNamespace != null) { + security.addNamespaceDeclaration(valueTypePrefix, + valueTypeNamespace); + } + + SOAPElement binarySecurityToken = factory.createElement( + Constants.WSSE_BINARY_SECURITY_TOKEN, Constants.WSSE_PREFIX, + Constants.WSSE_NS); + binarySecurityToken.addTextNode(token); + if (valueType != null && !valueType.isEmpty()) { + binarySecurityToken.setAttribute(Constants.WSSE_VALUE_TYPE, + valueType); + } + if (encodingType != null) { + binarySecurityToken.setAttribute(Constants.WSSE_ENCODING_TYPE, + encodingType); + } + + security.addChildElement(binarySecurityToken); + return security; + } + + private String getToken(MessageContext msgContext) { + + SOAPMessage sm = ((SOAPMessageContext) msgContext).getMessage(); + SOAPEnvelope envelope; + try { + envelope = sm.getSOAPPart().getEnvelope(); + SOAPHeader header = (SOAPHeader) Util.findElement(envelope, + new QName(envelope.getNamespaceURI(), "Header")); + + if (header == null) { + header = (SOAPHeader) envelope.getOwnerDocument() + .createElementNS(envelope.getNamespaceURI(), + envelope.getPrefix() + ":Header"); + } + return Util.findElementByWsuId(header, "BinarySecurityToken") + .getTextContent(); + + } catch (SOAPException e) { + log.error("Unable to create binary token", e); + return null; + } + } + +} \ No newline at end of file Modified: product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/jaas/JBWSTokenIssuingLoginModule.java =================================================================== --- product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/jaas/JBWSTokenIssuingLoginModule.java 2012-06-12 14:15:37 UTC (rev 1562) +++ product/trunk/picketlink-core/src/main/java/org/picketlink/trust/jbossws/jaas/JBWSTokenIssuingLoginModule.java 2012-07-04 14:43:50 UTC (rev 1563) @@ -22,6 +22,7 @@ package org.picketlink.trust.jbossws.jaas; import java.security.Principal; +import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.Set; @@ -44,6 +45,7 @@ import org.picketlink.identity.federation.core.wstrust.auth.STSIssuingLoginModule; import org.picketlink.trust.jbossws.PicketLinkDispatch; import org.picketlink.trust.jbossws.handler.BinaryTokenHandler; +import org.picketlink.trust.jbossws.handler.MapBasedTokenHandler; import org.picketlink.trust.jbossws.handler.SAML2Handler; /** @@ -74,10 +76,24 @@ } @Override - protected STSClient createWSTrustClient(STSClientConfig config) - { - return new JBWSTokenClient(config,options); - } + protected STSClient createWSTrustClient(STSClientConfig config) { + + String binaryTokenKey = (String) options + .get(MapBasedTokenHandler.SYS_PROP_TOKEN_KEY); + if (binaryTokenKey == null) { + binaryTokenKey = SecurityActions.getSystemProperty( + MapBasedTokenHandler.SYS_PROP_TOKEN_KEY, + MapBasedTokenHandler.DEFAULT_TOKEN_KEY); + } + Object binaryToken = sharedState.get(binaryTokenKey); + + Map<String, ? super Object> STSClientOptions = new HashMap<String, Object>(options); + if (binaryToken != null) { + STSClientOptions.put(binaryTokenKey, binaryToken); + } + + return new JBWSTokenClient(config, STSClientOptions); + } @SuppressWarnings("unchecked") @Override @@ -125,7 +141,7 @@ } @SuppressWarnings("rawtypes") - public JBWSTokenClient(STSClientConfig config, Map<String,?> options) + public JBWSTokenClient(STSClientConfig config, Map<String, ? super Object> options) { super(config); @@ -168,6 +184,10 @@ SAML2Handler samlHandler = new SAML2Handler(); handlers.add(samlHandler); } + else if (token.equalsIgnoreCase("map")) { + MapBasedTokenHandler mapBasedHandler = new MapBasedTokenHandler(options); + handlers.add(mapBasedHandler); + } else { ClassLoader cl = SecurityActions.getClassLoader(getClass());

12 years, 6 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

picketlink-commits July 2012